Opening SecureFlowSalesBleed: Agentforce in Slack Sends Attacker-Shaped Phishing Replies
Case summary & sources

AIDEFEND SecureFlow / SecureFlow Case Index

Zenity Labs aidefend-sf0052

SalesBleed: Agentforce in Slack Sends Attacker-Shaped Phishing Replies

  • Autonomous Agents
  • Credential & Identity Theft

Zenity Labs tested two routes against Agentforce in Slack. An external attacker could plant instructions in a CRM lead later read by an employee's agent; an internal caller could directly ask the agent to post. In the tested Slack Knowledge template, Reply to a Slack Thread lacked confirmation and invoker attribution, and a crafted URL survived redaction. Salesforce fixed the reported defaults and bypass by September 2026.

Mapped threat techniques

  • AML.T0051.001 LLM Prompt Injection: Indirect
  • AML.T0053 AI Agent Tool Invocation

Source

Updated